Cross-App Authentication with Device Attributes Against Session Hijacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, particularly in mobile devices, are inefficient and insecure, often relying on SMS-based verification which can be intercepted or exploited, and do not effectively prevent session hijacking through cookie theft.
Innovation Solution
Implementing a verification application on the mobile device that collects device attributes to generate a non-deterministic verifier for zero-knowledge proof, allowing secure authentication without revealing attribute values, and incorporating dynamic elements in data identifiers to detect compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS-based verification is used for user authentication, then ease of operation is improved, but security is worsened due to interception risks
Solution Approach 1:
The patent introduces a verification application as an intermediary component that mediates between the user and the authentication system. This verification app generates and manages device identifiers and attributes locally on the user's device, eliminating the need for SMS-based verification while maintaining ease of use. The intermediary verification app securely stores device attributes and generates verifiable credentials without exposing sensitive information, thus resolving the contradiction between operational simplicity and security.
2Ease of operation
If cookies are used for session authentication, then ease of operation is improved, but security is worsened due to cookie hijacking risks
Solution Approach 1:
The patent transforms static cookies into dynamic, verifiable credentials by introducing device attributes that change based on device state (location, time, network conditions). Instead of relying on fixed session cookies that can be stolen and reused, the system generates dynamic verification tokens based on current device attributes. This dynamic approach maintains the convenience of automatic authentication while preventing cookie hijacking, as stolen credentials become invalid when the device attributes change.
Solution Approach 2:
The verification application performs preliminary actions by pre-generating and storing device attributes and verifiable credentials locally on the user's device before authentication is needed. This preliminary setup eliminates the need for vulnerable session cookies during actual authentication, as the device can independently generate verification tokens using pre-stored attributes. The preliminary action of securing device attributes locally prevents the need for vulnerable session management mechanisms.
3Reliability
If device attributes are collected for zero-knowledge proof, then security is improved, but device complexity is worsened
Solution Approach 1:
The verification application implements self-service by autonomously collecting device attributes, generating verifiable credentials, and managing authentication without requiring complex user configuration or external infrastructure. The app automatically accesses device information (location, time, network state), generates cryptographic proofs, and manages storage locally. This self-service approach enhances security through zero-knowledge proofs while keeping the implementation relatively simple by leveraging existing device capabilities and automated processes.
Data Source
AI summary
According to examples, a system for enabling user authentication may include a processor and a memory storing instructions. The processor, when executing the instructions, may cause the system to receive user login credentials and initiate a user authentication process by receiving a challenge configured using an attribute of a system including the processor. The processor executes further instructions to determine the attribute value and to derive a zero-knowledge proof in response to the challenge. The zero-knowledge proof is provided to the challenge issuer to access services of one or more applications.